HCISPP Training Course

2.1 Applicable domestic and international regulations
2.2 Legal issues surrounding information security and privacy
2.3 Information flow
2.4 Data subjects, controllers, owners, and processors
2.5 Compliance frameworks
2.6 ISO, NIST, and IG toolkit
2.7 Compliance with Generally Accepted Privacy Principles (GAPP)
2.8 Responses for risk-based decisions
2.9 Compensating controls
2.10 Control variance documentation
2.11 Residual risk tolerance

3.1 Security objectives and attributes
3.2 Confidentiality of healthcare information
3.3 Protection of the integrity of the information
3.4 Availability of information as required
3.5 General privacy principles
3.6 Access control and data encryption
3.7 Maintenance of accuracy, completeness, and quality
3.8 OECD, GAPP, Privacy Principles, PIPEDA, and UK Data Protection Act
3.9 Personal and health information protected by law
3.10 Mitigating sensitivity, de-identification, and anonymization
3.11 Sensitive data and handling implications

4.1 Security and privacy governance
4.2 Information governance
4.3 Various governance structures
4.4 Risk management, methodologies, and activities
4.5 Risk management life cycles, including CMS, NIST, and ISO

5.1 Risk assessment
5.2 Lifecycle/continuous monitoring
5.3 Establishing desired outcomes
5.4 Roles of internal and external assessment/audit
5.5 Risk assessments consistent with job roles
5.6 Determining timelines for risk assessment
5.7 Gap analysis
5.8 Corrective action plans

6.1 Third-party standards and practices
6.2 Relationship management
6.3 Compliance requirements
6.4 Third-party assessments
6.5 Responding to security/privacy event notifications
6.6 Internal processes for incident response
6.7 Recognizing breaches and notifications and initial response to such breaches